General
- Target DhlshipmentInvoice.exe
- Size 284KB
- Sample210617-slcg3eg4ae
- SHA256 2467d796a3133b798ae7c8a27818d6ecc411da142b4dd2eb97edb650d7651bf8
- MD5 c9a58c5fa127fcd1e6dd33bc1ae96772
- SHA1 cd233d29e2a310c1b00d5d64079446c347575787
- SHA512 b1ae96c4790367e8b7ff9db3c0f7fb0d0a2b7ca0e03dbf5f1c9af217395dfa45c52286fbbb77618af4fc295203e2cc2a7681eb1604b78d22eb941d68952dd09b
- MD5 SHA1 SHA512
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
DhlshipmentInvoice.exe
Resource
win7v20210408
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
DhlshipmentInvoice.exe
Resource
win10v20210410
0 signatures
0 seconds
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.vnchangbao.com
-
Port
587
-
Username
-
Password
winners44
Targets
-
- Target DhlshipmentInvoice.exe
- Size 284KB
- SHA256 2467d796a3133b798ae7c8a27818d6ecc411da142b4dd2eb97edb650d7651bf8
- MD5 c9a58c5fa127fcd1e6dd33bc1ae96772
- SHA1 cd233d29e2a310c1b00d5d64079446c347575787
- SHA512 b1ae96c4790367e8b7ff9db3c0f7fb0d0a2b7ca0e03dbf5f1c9af217395dfa45c52286fbbb77618af4fc295203e2cc2a7681eb1604b78d22eb941d68952dd09b
- MD5 SHA1 SHA512
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Loads dropped DLL
-
Suspicious use of SetThreadContext